Push the reset button and then plug the power to the device keeping the button pushed. The leds will start blinking red and yellow, you can now release the reset button.
Now you can tftp the image to 192.168.1.20

Models of the Ubiquiti NanoStation family are quite similar to each other so the same images and instructions can be used for the listed devices.

This device is an integrated wifi spot designed to be used outdoor. With Ubiquiti Firmware (AirOS 3) it can act as station, station WDS, client, or client WDS. There are on-PCB antennas supporting vertical or horizontal polarity with the option to send RF to an external antenna via an on-board connector. RF output selection available in AirOS.

The Nanostation5 and Nanostation5 Loco come with 12V power supply, the internal DC-Converter is realized with a AP1509-33 PWM Control 2A Step-Down Converter. This can handle up to 24V but it is recommended to keep it below 20V, so if you have short cable use 12V and for longer cables 24V. (tested)

Opening the case

There are two screws under the label on the back. The newer M2 and M5 versions have just one screw under the label and two plastic pins that can be lifted out of their holes by pushing a plastic cable tie end next to them. After removing these, the board can be removed.

OpenWrt

NanoStation5 are supported by the OpenWrt AtherosPort. It is available as a pre-built image and can be built through buildroot.

Installing

The OpenWrt buildroot generates images that can be directly flashed to the NanoStation, usually with a name like atheros-ubnt5-squashfs.bin (for the NS5 or Loco5).

When flashing those images, the Ubiquiti web interface will show a warning about unsupported third-party firmware.
This warning can be ignored.

Upgrading

In order to upgrade from OpenWrt to a newer version, both the kernel mtd and filesystem mtd must be reflashed. The kernel is likely lzma compressed. If either mtd block isn't big enough, reflashing can not be completed through OpenWrt, but must be done through the RedBoot bootloader.

Recent versions of OpenWrt (8.09.2 and newer) support sysupgrade on this platform. To upgrade, put a combined firmware image into /tmp on the device and flash it using the sysupgrade command as outlined below.

7. Signal LEDs might be blinking during the upgrade. On a Nano5L, the power lights go back and forth.
7. Wait ~7 minutes before restarting or until the power lights stop their back and forth blinking.
7. Restart. The device should be back to its old configuration (OpenWrt doesn't overwrite or modify the NVRAM settings).

8. telnet to 192.168.1.1 and set a password with

passwd

Loading via tftp (bootloader contains client)

TFTP method uses the failsafe mode of the RedBoot bootloader of the hardware, which starts BEFORE OpenWRT. If you can't trigger it via reset button, you need to open your device and connect via Serial interface, then press Ctrl-C when RedBoot loads to get a RedBoot prompt.

Set your IP using ip_address, then get an image via tftp using load.

Restore Original AirOS firmware on Nanostation

To restore the original firmware, you cannot use mtd or sysupgrade - you must use the tftp method.

This is because the AirOS images are not sysupgrade-compatible. Uploading in luci does nothing and give you OpenWRT again after power cycle (so you can still try it without bricking your device if you don't believe me).

TFTP method uses the failsafe mode of the RedBoot bootloader of the hardware, which starts BEFORE OpenWRT. If you can't trigger it via reset button, you need to open your device and connect via Serial interface, then press Ctrl-C when RedBoot loads to get a RedBoot prompt. From this you can set an IP address (test pinging it afterwards) and then use TFTP.

On the redboot promt, help gives you a list of commands and syntax for the commands.

wifi failure, 632nd bit

If wireless does not work with eg. backfire 10.03.1 prebuilt firmware, and you get (in dmesg) "wifi%d: ath_attach failed: -22", then you may need to run the following script by Bill Moffitt. This script attempts to read the/a Flash configuration partition, set the regulatory domain (regdomain) to 0 if it is not already, erase the Flash partition, then write the old data with regdomain zero'd back to the Flash. WARNING: This script might brick your router (but it worked for me, User:green, on a NanoStation Loco2).